3

I would like to find files accessed by specific user (even just read) within a folder tree. I thought the find command had this option, but it actually just searches for owner user. Is there any other command, or command combinations? The stat command offers access information, but doesn't display the user who made access.

1

2 Answers 2

4

This information is not stored by traditional filesystems. You have three main options:

  • See who is accessing it in real time using lsof/fuser or similar;
  • Set up auditing (take a look at auditd);
  • Use something like LoggedFS.
3
  • how does auditd compare with inotify, referenced above by wollud1969?
    – atroon
    Dec 13, 2012 at 15:02
  • @atroon - Well, inotify can't notify you of which user did an action, so it seems irrelevant.
    – Chris Down
    Dec 13, 2012 at 21:58
  • Huh, so 'filesytem events' does not include users. Interesting. I read the descriptions thinking it might be useful without getting into the details of precisely which events and just presumed there would be something on who had touched the file last. Thanks.
    – atroon
    Dec 14, 2012 at 13:55
3

As far as I know, the only way to perform this is by activating auditd in your system. this way, it will log the access to all files and you can grep the logs files.

Be careful as the logging will be "heavy".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .